We are on computers, so everything can be changed all the time. E.g. there could be malware that changes a cloned git repos commits before you compile the softw

We are on computers, so everything can be changed all the time. E.g. there could be malware that changes a cloned git repos commits before you compile the software. If the commits are signed that malware would have to know the private key of that dev to do that, which is one additional hurdle that makes this kind of attack way harder to pull off.